feat: secure binary ZIP distribution, host views, and read-only inspection

[ORESoftware]

Summary

Adds secure native-binary ZIP packing, verification, publication, download, and a configurable human-readable host view.

zed binary pack
zed binary verify
zed binary publish
zed binary download

Release identity remains org/name/version; binary artifact identity additionally binds target and ZIP format without encoding platform data in SemVer.

Canonical archive

pkg/
.zpkg.toml
.zpkg-binary.json
bin/<declared entrypoint>
[explicit runtime payload]

.zpkg.toml is authoritative. Canonical .zpkg-binary.json binds package identity, complete [bin], structured platform, payload digest/size/executable intent, and optional source provenance. The outer SHA-256 binds the exact ZIP bytes.

Host layout

Successful downloads create an immutable verified view while retaining ~/.zed-pkg/store as the content-addressed authority:

~/.zpkg/downloads/
zed-org--acme/
[zed-project--payments/]
zed-package--tool/
versions/1.2.3/
zed/
targets/aarch64-linux-android/
artifact.zip
.zpkg-download.json
pkg/...

• project-qualified and projectless coordinates are unambiguous
• zed, github, gitlab, maven, npm, and cargo are real source directories
• targets/<target> prevents platform collisions
• project-first and package-first discovery indexes use hard links where possible
• ~/.zpkg/zpkg-config.toml can configure root, portable delimiter, source allow-list/precedence, and indexes
• colons remain valid in logical URIs but physical paths default to Windows-safe zed-org--... segments
• existing views revalidate archive, descriptor, payload inventory, digests, modes, and binding metadata before idempotent reuse

Security and determinism

• explicit payload collection; no build-tree sweep or package-code execution
• deterministic sorted Deflate-6 output, DOS epoch, normalized modes, and post-pack verification
• rejects traversal, links/special files, duplicate/portable collisions, Win32 device/ADS names, file/ancestor conflicts, directory data, encryption, data descriptors, unnecessary ZIP64, archive comments, and central-directory gaps
• bounded archive/expanded bytes, entries, components, descriptors, manifests, and compression ratio
• atomic no-clobber pack/download/host-view promotion and immutable file:// qualified storage
• registry size/SHA, manifest, descriptor, platform, provenance, evidence, payload hashes, and executable intent are rebound
• credential-bearing registry URLs are rejected; signed-query redirects remain pinned to the original HTTPS origin
• shared interface pin 8428bc574111fa148e590c8350c7855035ce2046 includes merged binary contract feat(DEN-1418): add deterministic frozen Zed→Nix export plans #64 and manifest aliases
• live workflows pin merged server a483572594758196adf906119b46e594aa921622

Registry and R2 status

The legacy deployed route carries one immutable binary ZIP per version. Qualified file:// transport implements the shared target-qualified contract; qualified HTTP persistence/handlers remain an explicit server follow-up documented by zed-api-server.rs#38.

Pull requests run credential-free native and Android ARM64 preflights. Live R2 certification is now dispatch-only from upstream main behind the protected r2-release-publication environment; PR code cannot solicit credentials through comments, logs, annotations, or artifacts. A prior actual-R2 certification passed exact-object upload, HEAD, registry/direct/presigned download, digest verification, out-of-scope denial, idempotency, and cleanup. Physical Android execution is not claimed.

Validation

Exact merged tree:

• cargo test --locked --all-targets: 423/423 library tests plus all integration targets
• strict cargo clippy --locked --all-targets -- -D warnings
• host-layout tests: 7/7
• binary archive tests: 7/7
• adversarial archive tests: 6/6
• alias validation tests: 7/7
• workflow policy tests: 17/17; repository workflow audit passed
• graph contract/schema byte comparison, Bash syntax, format, diff, conflict-marker, and credential scans passed

Linear: DEN-3495

[linear-code]

DEN-3495

[ORESoftware]

Semantic reconciliation update: this branch now contains the current merged main (including PR #265) and preserves both feature families from PRs #266 and #270. Conflict resolution retained the existing task/graph/native/OCI command families, added the read-only static inspection command, bypasses transaction recovery only for inspection, keeps project-scoped recovery locking for mutable commands, and routes explicit or manifest-declared Git submodule consumption through the same locked install path. Local verification on exact head 1c775ff passed cargo fmt, locked all-target cargo check, 502 library tests, and every integration target; only the two explicitly Nix-dependent tests remained ignored by design.

[ORESoftware]

CI follow-up on exact head eae900d: restored the Windows-only std::io::Read import required by shebang inspection without creating a Unix unused import, and removed the two needless Path borrows rejected by the all-target -D warnings gate. Local cargo fmt, locked all-target Clippy with warnings denied, 19 Git-submodule tests, and 6 read-only inspect CLI tests pass. The fixes were committed through an isolated index so the separate local publish-ignore work was not staged, altered, or published.

[ORESoftware]

Local R2 harness recovery audit — 2026-08-20

A removed-worktree sweep recovered the one-off r2-live-cert.cjs harness (SHA-256 c2146e9e60b29cf0c8082947e69773cc6958ebac9cbdae9c41b78ee083c3a2f7) plus its tiny source fixture. It also recovered generated binary-smoke and ZIP output; the ZIP SHA-256 is d8cd3d1ee31f2c36579cd14898df8bf0b20e6706c93f7c034123e657b23b0d66.

Recovery validation passed: Node syntax, fresh C compilation/execution, ZIP integrity, and a targeted credential/private-key scan. The harness embeds no credential; it reads temporary values from stdin. Its archive descriptor cites source 8358d7bcbdf23b030c590a1bc74ed5ef7d063e56, which is no longer a reachable GitHub commit.

This is historical certification scaffolding, not an unpublished product delta. It uses ephemeral absolute /tmp dependencies and is superseded by current main at dbd63f1d87d12c2e8cb9a8c600fae9b79f94e559, including the protected R2 binary/Android workflows and permanent temporary-credential scripts. Consistent with this PR's deliberate removal of temporary certification scripts before merge, the stale harness and generated artifacts were not republished or committed. DEN-3495 remains the canonical WIP for the remaining qualified-HTTP/physical-device boundaries.